Hacker News Reader

Comment by silon42 | Hacker News Reader

This is also a problem for lots of banking in the EU now (with some exceptions -- using hardware TOTP or similiar device).

I can't login into the bank without the phone. Also you can't verify online payments in most locations without the app.

Previously the digital certificates were used.

View on HN

Yep, my bank forces me to use an Android/iOS only app. As far as I'm aware, there's not a single bank in my country that supports open 2FA standards, like FIDO2.

Infuriating, and it's only going to get worse. And then the EU complains about Google/Apple's monopoly power - I wonder why...

There's a single one in my country (Boursorama). Even more infuriating, banks are now forcing clients to use their apps to add beneficiaries without an artificial delay or to make an instant SEPA transfer.

> FIDO2

Lacks the reference to a transaction. An attacker could send unlimited transactions for 15 seconds after you approved yours.

You can include the transaction ID in the clientDataHash calculation, which will be signed by the authenticator. This protects against that attack.

https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-cl...

The layer below does not have to protect against replay attacks. In fact solely relying on such a protection would be a security issue itself. The user could just generate the TAN here and sign the transaction.

1 transaction every ($interval * 1.5) seconds ought to be enough for most non-commercial banking users? Even if you could tie the token to a non-separable 'bundle' of transactions for larger transactions (Payroll for all staff?)

Banking IT seems to have their heads in the clouds of regulations, and risk aversion to even proven modern secure solutions.

An attacker who has compromised the bank’s servers could, sure. But at that point don’t you have bigger problems?

Well, the PSD2 opens the banking to third parties (basically OAuth, just for banks).

So an approved payment initiation services (PIS) can do transactions on your behalf. But you still want to have control over which transfers they actually send, so you want to make sure the confirmation code only works for a certain transaction.

I believe this would have to be implemented by the payment initiation service provider - as far as the bank is concerned, once you authorize the PIS provider the have full access and can initiate any transfers they want.

Compromising bank servers is less harmful than compromising individual customers, because it's the bank (or perhaps the insurance) that's bearing the consequences, not its customers.

My bank has desktop apps but not for Linux. The only other alternative to a smartphone is a hardware TAN generator and they won't give me one because I "don't need it".

At the same time they only allow a 5-digit pin as password for everyone, and as the phone is the second factor it doesn't have 2FA itself. The 5-digit pin is enough to access everything, you don't even need a username because the app is tied to the account.

It's obvious they just threw something together to comply with regulations.

> It's obvious they just threw something together to comply with regulations.

Far worse, there is no regulation to force any of this it's just competition. Mostly by smaller "banks" with even worse track records concerning security.

There is regulation, that's why we have mandatory 2FA for bank accounts. I think (but am not sure) that SMS phase-out is also part of that regulation, but that might also just be banks being happy to force their software onto more devices to do who knows what.

I contacted my UK bank about this and they switched me to using an email confirmation where they send the OTP code to instead of via SMS. For my digital account, they previously sent me a card reader which the login process still accepts.

Which bank is that?

Reply on news.ycombinator.com